Dashboards & Visualizations

How to use count for activity updates

jsalsbur
Explorer

Good morning
I am working on a Splunk dashboard where there's a site with 15 different firewall rules. I want to set up a single number that auto updates and shows that the rules are all active.
So it would be green at 15 and anything less, 14 -1 would should as yellow,
technically I would like if it drops before the half to go red but I'm fine with green and yellow for now.

I am doing index=firewallindexname sourcetyp=firewallsourcetype sensor=rule1 OR sensor=rule=2 and so on
This is where I hit the brick wall, I wanna do count- but not the count of the firewall rules used- just the fifteen different ones if they are active.

0 Karma
1 Solution

jsalsbur
Explorer

found my own answer, just use stats count, not stats count by.....

thanks

View solution in original post

0 Karma

jsalsbur
Explorer

found my own answer, just use stats count, not stats count by.....

thanks

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...